TOOLBOX · DOWNLOAD
ReviewMicrosoft 365licenses.
Whether Conditional Access, protection against phishing links, or endpoint protection is available depends on the Microsoft 365 plan. At the same time, many companies pay twice for features, for example for add-on licenses that are already included in the bundle, or for accounts of former employees. Based on the service descriptions on Microsoft Learn, this checklist shows which security features the Business plans and Microsoft 365 E5 include, where licenses are typically duplicated or unused, and how you check this in the Microsoft 365 admin center and with Microsoft Graph PowerShell. It deliberately contains no prices.
Free PDF · Checklist
Reviewing Microsoft 365 Licenses: Security Features and Duplicate Licenses
- Format
- PDF, A4
- Length
- 6 pages
- Size
- 100 KB
- Updated
- Oct 25, 2026
- Sources
- 14
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
Security features of the Business plans and Microsoft 365 E5, typical duplicate licenses, and the review in the admin center and with PowerShell, without prices.
- Executive management of small and medium-sized companies that use Microsoft 365
- IT management and Microsoft 365 administrators
- Purchasing and accounting teams that review license invoices
- IT service providers that manage licenses for customers
5 SECTIONS
What Is
Inside.
- 01
Why the license helps determine security
Many protection features depend on the plan; Business plans are limited to 300 licenses.
- 02
Which security feature is included in which plan
Business Basic and Standard, Business Premium, and Microsoft 365 E5 according to the service descriptions on Microsoft Learn.
- 03
Where companies pay twice or for nothing
Eight typical places that you can find with the steps in section 04.
- 04
How to review your licenses
In the Microsoft 365 admin center, in the Microsoft Entra admin center, and with Microsoft Graph PowerShell.
- 05
Checklist: licenses and security
To check off, ideally once per quarter and before every contract renewal; TOMORIS recommendation.
EXCERPT
Which security feature is included in which plan
| Area | Basic, Standard | Business Premium | Microsoft 365 E5 |
|---|---|---|---|
| Microsoft Entra ID | Free with security defaults | P1 with Conditional Access | P2, plus ID Protection and PIM |
| Email protection | Built-in protection for all cloud mailboxes | Defender for Office 365 Plan 1 | Defender for Office 365 Plan 2 |
| Phishing simulation | Not included | Not included | Attack simulation training |
| Device management | Basic Mobility and Security | Intune Plan 1 | Intune, from July 2026 with Plan 2 and additional suite features |
| Endpoint protection | Not included | Defender for Business | Defender for Endpoint Plan 2 |
- Defender Suite for Business Premium
- Add-on license for Business Premium with Microsoft Entra ID P2, Defender for Identity, Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, and Defender for Cloud Apps.
- Microsoft 365 E3
- According to Microsoft, includes Microsoft Entra ID P1 and Defender for Endpoint Plan 1. Two Microsoft pages describe differently whether Defender for Office 365 Plan 1 is included; check the service plans in your own tenant.
- Defender for Business
- Endpoint protection for organizations with up to 300 users, included in Business Premium and also available separately for Business Basic and Standard; according to Microsoft, comparable to Defender for Endpoint Plan 1 plus some features from Plan 2.
SOURCES
Supported
by Sources.
- Microsoft Learn: Microsoft 365 for business security overview (opens in a new tab)Table of security areas, Defender Suite, account, email, and device protection
- Microsoft Learn: Microsoft 365 Business Premium frequently asked questions (opens in a new tab)Limit of 300 licenses across all Business plans
- Microsoft Product Terms: Microsoft 365 (Microsoft Customer Agreement) (opens in a new tab)Microsoft 365 Business Basic/Standard/Premium Use Rights
- Microsoft Learn: Microsoft Entra licensing (opens in a new tab)P1 and P2 per bundle, ID Protection
- Microsoft Learn: Microsoft Defender service description (opens in a new tab)Licenses with rights to Defender for Office 365 Plan 1 and 2
- Microsoft Learn: Microsoft Defender for Office 365 overview (opens in a new tab)Plan 1 and Plan 2, statement on E3
- Microsoft Learn: Microsoft Defender for Business, frequently asked questions (opens in a new tab)E3 and E5 with Defender for Endpoint, viewing licenses in the admin center
- Microsoft Learn: View Microsoft 365 licenses and services with PowerShell (opens in a new tab)Get-MgSubscribedSku, Enabled and ConsumedUnits
- Microsoft Learn: Group-based licensing PowerShell examples (opens in a new tab)Directly assigned and inherited licenses, unnecessary direct assignments
- Microsoft Learn: Assign or unassign licenses to a group in the Microsoft 365 admin center (opens in a new tab)Errors & issues, conflicting service plans
- Microsoft Learn: Delete a user from your organization (opens in a new tab)Continued payment until the license count is reduced, shared mailbox without a license
- Microsoft Learn: Remove and delete a license from a former employee (Step 6) (opens in a new tab)Release holds first, 30 days, SharePoint exception
- Microsoft Learn: Create a shared mailbox (opens in a new tab)License required above 50 GB, with archive and retention
- Microsoft Learn: Microsoft Intune planning guide (opens in a new tab)Step 3: suite features in E3 and E5 from July 2026
This checklist is a TOMORIS recommendation and reflects the Microsoft service descriptions as of October 25, 2026. License contents change; the current Microsoft Product Terms and service descriptions are authoritative. It does not replace licensing advice.
TOOLBOX
Explore
Further.
- Kostenlos
Microsoft 365 domain check (German)
Tenant, Exchange Online, DKIM
Check Now Microsoft licenses
Clarify your needs, review existing Microsoft 365 licenses, and receive a suitable offer with personal advice.
Learn MoreMFA in Microsoft 365
Checklist from security defaults through Conditional Access to passkeys, without locking yourself out.
Learn MoreMicrosoft 365
What Microsoft 365 covers, from Office applications to cloud services for email and device management, in the glossary.
Learn More
EMAIL & MICROSOFT 365
More on
This Topic.
- PDF
SPF, DKIM and DMARC
From an inventory of all senders to the p=reject policy: a rollout plan with DNS examples based on current standards, including DMARC RFC 9989.
View - PDF
MFA in Microsoft 365
Security defaults or Conditional Access, emergency access accounts, choice of methods, rollout in report-only mode and Microsoft’s mandatory MFA: roll out MFA without locking yourself out.
View - PDF
Microsoft 365 Security Checklist
The most important security settings per service to check off: accounts and roles, email, protection against malware, sharing, Teams, and logs, based on CISA SCuBA and Microsoft Learn.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.